Dependencies

Explicitly declare and isolate dependencies. A twelve-factor app never relies on a package just because it happens to be installed on the machine. Two things make that true:

• Declaration: a file in the repo lists every package and its version. For Python that's requirements.txt; for Node it's package.json.
• Isolation: the packages are installed somewhere only this app sees, like a virtual environment or a container, so nothing from the system leaks in.

#Declare them

fastapi==0.115.0
uvicorn==0.30.6
sqlalchemy==2.0.35

Pin exact versions. "Whatever was newest when I installed it" is how two machines end up running different code.

#Isolate them

A new developer should be able to clone the repo and get a working app with the same few commands every time.

$ git clone https://github.com/acme/shop && cd shop
$ python -m venv .venv
$ source .venv/bin/activate
$ pip install -r requirements.txt
Collecting fastapi==0.115.0
Collecting uvicorn==0.30.6
---> 100%
Successfully installed fastapi-0.115.0 uvicorn-0.30.6 sqlalchemy-2.0.35
$ uvicorn main:app
INFO:     Uvicorn running on http://127.0.0.1:8000

The .venv folder belongs to this app alone. Delete it and run the same commands, and you get the same packages back.

#System tools count too

If the app shells out to curl or ffmpeg, that's a dependency as well, and the machine may not have it. Declare it the same way, in a Dockerfile, so every image has it:

FROM python:3.12-slim
RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["uvicorn", "main:app", "--host", "0.0.0.0"]